Bonneville Collections Listed by lorenz Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Bonneville Collections Listed by lorenz Ransomware Group (reported June 27, 2022) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The incident came to public attention when Bonneville Collections appeared on the Lorenz group's leak site. The group claims to have stolen internal data from the organization. No further technical details, such as the date of the intrusion, the method of initial access, or the volume of material taken, have been disclosed in available reporting. The number of people whose information may be involved remains unknown.
Who is lorenz?
Lorenz is a ransomware operation that has conducted intrusions against organizations in multiple sectors since at least 2021. The group is known for encrypting systems and then threatening to publish stolen files on a dedicated leak site if a ransom demand is not met. Its listings typically include a sample of files and a deadline for payment. Public records show the group has targeted entities in finance, manufacturing, and professional services in prior incidents, though each victim listing stands as an unverified claim by the group until independently confirmed.
About Bonneville Collections
Bonneville Collections operates as a debt-collection agency. Organizations in this sector routinely receive and store personal and financial records from creditors, including names, addresses, account numbers, and payment histories. Such data is necessary for locating debtors and processing collections, yet its sensitivity makes the firm a potential target for actors seeking monetizable information or leverage.
What was likely exposed
The only detail provided is that internal files were allegedly exfiltrated. The precise categories of data contained in those files have not been disclosed. Debt-collection firms commonly hold records that include personal identifiers, contact information, and financial account details, but it is not confirmed whether any of these specific elements were among the material taken in this case.
Why it matters
Exposure of internal files from a collections agency can increase the risk that individuals face identity theft or financial fraud, because the records often contain the types of information needed to open accounts or file false claims. For the organization, the incident may trigger regulatory review and added costs for investigation and notification. The absence of a confirmed data inventory leaves both the scale of potential harm and the organization's response obligations unclear.
If your data was in this claimed breach
Individuals concerned about possible exposure should review their credit reports for unfamiliar accounts, place fraud alerts with major credit bureaus if warranted, and monitor bank and credit-card statements for unauthorized activity. Running a free exposure scan of an email address against known breach data sets can indicate whether the address has appeared in previously published collections. Organizations that held accounts with Bonneville Collections may also contact the firm directly for any official notification it issues.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
AmCham Shanghai Listed by lorenz Ransomware GroupSimply Placed Listed by lorenz Ransomware GroupAdvizrs Listed by lorenz Ransomware GroupBiz Retek Listed by lorenz Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Bonneville Collections Listed by lorenz Ransomware Group →
Publicly posted by lorenz — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.